docs(plugins): integrate official bundled delivery

.project-docs/20-architecture/data-flow.md

@@ -6,7 +6,8 @@
 |---|---|---|---|
 | Marketplace catalog and Account Library | Signed-in Renderer intent | bounded Host API → Main Marketplace client/cache → Works Square catalog, Library, resolve, Admission, and download APIs | Main binds requests to the current Account and response generation. Free acquisition changes only Account Library; it does not install, enable a project, assign an Agent Skill, or authorize runtime execution. |
 | Marketplace device installation | Account Library entry and explicit channel | Main resolve/Admission/download → descriptor/signature/archive/client compatibility verification → immutable Package Store index switch | Stable and explicit Beta remain distinct even when they resolve to the same immutable Release. Failed install/update retains the previous current release; explicit uninstall waits only for protecting worker/account references and completes after the final worker exits. |
-| Effective Plugin worker snapshot | Installed trusted package + project selection + Agent assignments + current server policy | effective resolver → Registry/resource loader/Extension Host/tool catalog → parent Pi worker | One frozen snapshot supplies Skills, tools, package roots, and runtime authorization. Disable, account/project switch, logout, Renderer crash, Main shutdown, or worker generation change invalidates future actions without mutating persisted unknown assignments; child workers receive no Plugin projection. |
+| Official bundled hosted Plugin acquisition | Account Library entry for Game Resource or Web Search | server stable bundled Release/Admission + MakeLore resource package | Free acquisition changes Library only. No device download, update, Beta, signature, or device-uninstall action exists for these exact code-owned identities. |
+| Effective Plugin worker snapshot | Installed trusted package or acquired official bundled definition + project selection + Agent assignments + current server policy | effective resolver → Registry/resource loader/Extension Host/tool catalog → parent Pi worker | One frozen snapshot supplies Skills, tools, package roots, and runtime authorization. Disable, account/project switch, logout, Renderer crash, Main shutdown, or worker generation change invalidates future actions without mutating persisted unknown assignments; child workers receive no Plugin projection. |
 | Hosted Game Resource operation | Eligible parent `makelore.game-resource` tool call plus explicit confirmation | frozen Plugin adapter → capability Registry → Main `GameResourceClient` → fixed Works Square game-resource route → provider-neutral receipt/result | Server policy owns pricing, payer, Admission and receipt state. Stable logical operation identity survives response loss/Main restart; `submission_unknown` is not replayed as a fresh request. Result saving uses a bounded project-relative path and the existing project write lease. |
 | 桌面认证生命周期 | Renderer 登录、刷新与注销请求 | Host API → Main Works Session → Works Square `/api/auth/{login,mobile-login,refresh,logout}` → one-feel auth | Main 加密持有并先持久化轮换 token；客户端不携带 OAuth client secret；连续 7 天未使用才清除会话，终止性 `400`/`401` fail closed |
 | 用户模块入口策略 | 会话恢复 / 登录 / 刷新 | Electron Main → Works `/api/auth/me` → 四布尔安全投影 → Renderer auth store → 卡片/路由/provider gate | 缺失对象或字段默认 `true`；`design` 映射 `painting`；终止性 `401` 清理 Main/Renderer 会话；全局 `/settings` 不受 Code gate |

.project-docs/20-architecture/module-map.md

@@ -4,9 +4,9 @@
 
 | Path | Responsibility | Owner Notes |
 |---|---|---|
-| `electron/coding-plugins/manifest.ts`, `release-descriptor.ts`, `signature-verifier.ts`, and `trusted-keys.ts` | Closed Plugin package/descriptor parsing, compatibility checks, canonical archive validation, and Ed25519 trust | Schema 1 bundled compatibility and schema 2 `skill_only`/declarative `platform_hosted` are parsed fail closed. The production trust store accepts no Marketplace package until the official public key is built in. |
+| `electron/coding-plugins/manifest.ts`, `release-descriptor.ts`, `signature-verifier.ts`, and `trusted-keys.ts` | Closed Plugin package/descriptor parsing, fixed code-owned resource roots, compatibility checks, canonical archive validation, and Ed25519 trust | Data Service plus exact Game Resource/Web Search roots are code-owned. Other schema-2 `skill_only`/`platform_hosted` packages remain signed Marketplace artifacts and fail closed without the official public key. |
 | `electron/coding-plugins/account-plugin-cache.ts`, `marketplace-client.ts`, and `package-store.ts` | Main-owned Account Library cache, authenticated server client, and atomic immutable device installation store | Account acquisition and device installation are separate. Package bytes switch atomically only after descriptor, signature, archive, client-range, and provenance checks; failed updates preserve the prior current release. |
-| `electron/coding-plugins/effective-resolver.ts`, `registry.ts`, `project-service.ts`, and `electron/coding-runtime/pi/**` | One effective installed-plugin projection and frozen parent logical-thread runtime snapshot | Project enablement and Agent Skill assignment are preserved independently. Only trusted, compatible, installed, policy-admitted resources enter a new parent logical thread; child workers remain empty and active threads retain frozen bytes until disposal. |
+| `electron/coding-plugins/effective-resolver.ts`, `registry.ts`, `project-service.ts`, and `electron/coding-runtime/pi/**` | One effective Plugin projection and frozen parent logical-thread runtime snapshot | Project enablement and Agent Skill assignment are preserved independently. Trusted installed artifacts or exact acquired official bundled definitions may enter a policy-admitted parent logical thread; child workers remain empty and active threads retain frozen resources until disposal. |
 | `electron/coding-plugins/adapters/game-resource.ts` and `electron/services/game-resource-client.ts` | Provider-neutral `makelore.game-resource` hosted tool adapter and Main-owned Works Square transport | Tools materialize only from an eligible frozen `platform_hosted` parent snapshot. Metered mutations require explicit confirmation and stable logical operation identity; Renderer/Pi never receive Provider URLs, credentials, balances, raw responses, or Provider job IDs. |
 | `electron/api/routes/plugin-marketplace.ts`, `src/stores/plugin-marketplace.ts`, `src/pages/PluginMarketplace/`, `src/pages/MyPlugins/`, and `src/pages/ProjectPlugins/` | Bounded Main routes and Renderer projections for catalog, Library, device, and project actions | Renderer receives no Account token, filesystem path, Admission, package bytes, or signed download URL. Catalog/Library/device/project generations prevent stale A/B or cross-action results from replacing current state. |
 | `src/components/works/ProjectPublishAction.tsx` | 可发布项目的一键提交、云构建轮询与用户可理解状态 | 只通过 Renderer API 提交非敏感元数据；绑定告警不终止轮询 |

.project-docs/20-architecture/system-overview.md

@@ -23,7 +23,7 @@ Makelore 是 Electron 桌面客户端。Renderer 负责项目操作与状态展
 | Pi Conversation Runtime | 一个长驻 Pi `0.84.2` Agent Server 承载每条 active/warm Conversation 的隔离逻辑 Runtime/Session/JSONL channel | 严格 LF JSONL RPC、generation recovery、Snapshot hydration；top-level 逻辑 turn 并发 4、warm idle LRU 8；Server 退出统一使旧 channel 失效并按需单实例重启 |
 | Pi Provider & Managed Resources | Provider catalog、thread-local secret projection、model/resource revision、Prompt/Skill/extension materialization | 父凭据只进入选中逻辑线程的内存 credential store，child 凭据只进入该短命进程；Works `model_capabilities` 由 Main 严格归一化并作为安全 Provider metadata 持久化，服务端 reasoning levels 优先于本地 profile，缺字段则清理 override 并回退；不扫描项目或用户的 `.pi/.agents/.codex`，不把 secret 或原始响应放进 argv、catalog 或 Renderer |
 | Pi Extension, Subagents & Lifecycle | 唯一显式 Makelore extension、UI interaction、ephemeral child、write lease 与 background run lease | child 并发 4、单次最多 8、禁止递归；active/uncertain run 不因页面隐藏或 confirmation timeout 被停止，replacement/stop 必须可解释并清理所有 ownership |
-| Native Web Search Plugin | Signed Marketplace Package → effective parent snapshot → code-owned Main adapter → fixed Works Square Web Search route | Renderer/Package/Pi 不持有 Provider key、model 或 URL；每次搜索要求显式确认，closed receipt 与 result-less uncertain state 由 Main 投影，child 不继承 hosted tool |
+| Official Hosted Plugins | Acquired code-owned bundled Game Resource/Web Search package → effective parent snapshot → code-owned Main adapter → fixed Works Square hosted route | 无设备下载、更新、Beta 或签名步骤；Renderer/Package/Pi 不持有 Provider key、model 或 URL。每次计费操作要求显式确认，child 不继承 hosted tool。 |
 | AI Design Workspace & Living Form | 一个 Workspace 的当前 Direction、Current Specification、持久 Agent Session、conversation timeline、Tasks 与 Assets | Living Form 是服务端 Current Specification 的投影；Renderer 只持有草稿和已接受投影 |
 | AI Design Input & Reconciliation | Chat、字段/集合编辑、decision、proposal、lock、Asset binding 与 restore | 全部进入同一 `design.input.apply` reducer；稳定 command/operation ID 支持 unknown-result 重放，revision conflict 刷新权威状态 |
 | AI Design Gateway Routing | Main-owned Works Square V2 adapter 与 Direction event stream | Main 持有 Works Token、stream ticket、WebSocket、重试分类和错误脱敏；事件顺序与 Task progress 不构成 Specification 真值 |

.project-docs/30-worklog/current-state.md

@@ -4,6 +4,16 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
 
 ## Integrated Through
 
+- Official bundled Plugin client cutover is integrated on local `main` through product
+  commit `1530ac774091c7083dbff19e0fbd69e929ac8718` by task
+  `20260901-official-bundled-plugins-client-integration-b8d5f3a2`. Game Resource and
+  Web Search now ship as exact schema-2 resource packages with MakeLore; their acquired
+  Library entries resolve through the server Admission path without Package Store
+  download, update, Beta, signature, or device-uninstall state. Project enablement,
+  Agent assignment, parent-only materialization, Provider policy, confirmation, and
+  Token Point billing remain enforced. The verified Windows installer embeds source
+  `b1657300f29f9744551f31029eb192ee82f01b92`, is 208,297,578 bytes, and has SHA-256
+  `449288AF079E030F3F700F0FF1701971F7AB4806E0366CE989F4E8F2FE33ACA3`.
 - Conversation abort reconciliation source
   `d2ef37bc4d7d3609cec0a55c4ae8ffb2734696d5` from task
   `20260901-conversation-abort-stall-6f4c2a91` is merged into local `main` as
@@ -64,8 +74,8 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
   and was installed over the prior 1.2.0 at the existing user-selected location.
   The signed-in installed client then loaded the deployed generation-2 catalog and
   rendered exactly Data Service, Game Resource, and Web Search without the unavailable
-  catalog error. Game Resource and Web Search still honestly show no stable Release;
+  catalog error. At that checkpoint Game Resource and Web Search still showed no stable
-  production signing/publication activation remains a separate gate.
+  Release; the official bundled cutover recorded above supersedes that delivery model.
 - Packaged Pi Agent Server resolver fix source `7df245af5a04f62be48980831ff41987ba686009`
   from task `20260901-local-runtime-unavailable-8b42c7f1` is promoted to local
   `main` by task `20260901-promote-local-runtime-main-a7c4e291` through verified

.project-docs/30-worklog/tasks/20260901-official-bundled-plugins-client-9d5f3b82.md

@@ -1,51 +0,0 @@
-# Task: Use official bundled Plugins without Marketplace Release download
-
-## Identity
-
-- Task ID: 20260901-official-bundled-plugins-client-9d5f3b82
-- Mode: Feature
-- Branch: codex/20260901-official-bundled-plugins-client-9d5f3b82-official-bundled-plugins
-- Worktree: D:\Datas\OthersProjects\makelore-official-bundled-plugins-9d5f3b82
-- Base commit: 52e2a97a12ffaf838c3218795ff33e7fb91940cf
-- Owner: codex-root
-- Status: In Progress
-
-## Scope
-
-- Ship the code-owned Game Resource and Web Search package resources inside MakeLore.
-- Materialize acquired bundled optional Plugins without a Package Store download while retaining policy/admission checks.
-- Show bundled delivery honestly in Marketplace/My Plugins/Project Plugins and hide only device-package actions.
-- Cover manifest, effective resolution, hosted admission, Renderer projection, and artifact reachability with focused tests.
-
-## Intent And Constraints
-
-- Preserve free account acquisition/removal, project enablement, Agent assignment, lifecycle invalidation, and Token Point billing.
-- Preserve signed artifact download/update behavior for non-bundled Marketplace Plugins.
-- Do not add Provider authority or secrets to the client.
-- Keep unknown/removed Plugin configuration preservation unchanged.
-
-## Outcome
-
-- Game Resource and Web Search are now fixed schema-2 code-owned bundled definitions with deterministic server Release IDs. Their exact package manifests, capability contracts, and Skills ship under `resources/coding-plugins/**` and match the server source bytes.
-- Effective resolution still requires the current Account Library entry, project enablement, Agent assignment, policy, and billing readiness, but no longer consults Package Store bytes for these official definitions. Registry definition lookup and hosted Admission resolve the exact bundled Release and reject any server drift.
-- My Plugins shows “随 MakeLore 提供” and removes download/update/Beta/device-delete actions for official bundles while retaining Account removal, project enablement, and Agent assignment. Project Plugins no longer reports them as missing a device download.
-- Third-party Marketplace package parsing, signature trust, Package Store installation, and lifecycle remain unchanged.
-
-## Verification
-
-- Initial RED: five official-bundle assertions failed while 33 adjacent tests passed, proving only Data Service was loaded and hosted Plugins still depended on Package Store.
-- Registry-boundary RED: bundled `getInstalledDefinition(releaseId)` returned null; GREEN now returns the fixed bundled definition without `getInstalledRelease`.
-- Focused manifest/effective resolver/Admission/resource-loader/UI suite: 57 passed across 6 files; broader adjacent suite: 133 passed.
-- Full unit diagnostic before the final registry correction: 214 files ran with 1,781 passed and 2 skipped; two Windows process-spawn tests failed with transient `spawn EBUSY`, then passed 3/3 alone with one worker. Pressure test passed 1/1.
-- TypeScript typecheck and scoped ESLint pass. `pnpm run build:vite` passes all Renderer/Main/Preload/utility builds (2,272 Renderer modules).
-- Server/client Game Resource and Web Search resource trees are byte-identical under `git diff --no-index`.
-- Windows package/artifact verification is pending the final source commit so embedded commit evidence names the exact deliverable.
-
-## Follow-ups
-
-- Integrate the sole source commit into the client `main` root without touching its unrelated untracked task record, then build and verify the Windows package.
-- The matching Works Square deployment must reach migration `0078`; Provider/pricing readiness remains server-owned.
-
-## Promotion Candidates
-
-- None recorded.

.project-docs/30-worklog/tasks/20260901-official-bundled-plugins-client-integration-b8d5f3a2.md

@@ -0,0 +1,47 @@
+# Task: Integrate official bundled Plugins into MakeLore main
+
+## Identity
+
+- Task ID: 20260901-official-bundled-plugins-client-integration-b8d5f3a2
+- Mode: Integration
+- Branch: main
+- Worktree: D:\Datas\OthersProjects\makelore
+- Base commit: 52e2a97a12ffaf838c3218795ff33e7fb91940cf
+- Owner: codex-root
+- Status: Ready for Integration
+
+## Scope
+
+- Integrate product commit `b1657300f29f9744551f31029eb192ee82f01b92` onto client `main`.
+- Record bundled optional Plugin delivery in canonical project memory and verify the exact integrated tree.
+- Preserve the unrelated untracked `20260901-package-122-c5e8` task record byte-for-byte.
+
+## Intent And Constraints
+
+- Preserve account acquisition/removal, project enablement, Agent assignment, hosted Admission, and Token Point billing.
+- Keep third-party signed Artifact installation unchanged and keep Provider secrets out of the client.
+- Do not publish, deploy, or overwrite the existing user-owned task record.
+
+## Outcome
+
+- Product source `b1657300f29f9744551f31029eb192ee82f01b92` was cherry-picked onto local `main` as `1530ac774091c7083dbff19e0fbd69e929ac8718`.
+- Game Resource and Web Search package manifests, Skills, and tool catalogs now ship under fixed MakeLore resource roots and resolve without Package Store installation.
+- My Plugins and Project Plugins project the official bundled model: Account remove/project enable/Agent assignment remain, while download/update/Beta/device-delete and “not downloaded” states are absent.
+- The foreign feature task record was removed only from the integrated branch; its isolated source branch remains intact. The unrelated untracked `20260901-package-122-c5e8.md` file was preserved.
+- Canonical architecture, data-flow, domain rules, and current-state memory now describe the bundled optional Plugin boundary.
+
+## Verification
+
+- Exact integrated focused run: 61 passed across manifest, effective resolver, hosted Admission, resource loader, Marketplace UI, and product artifact verifier tests.
+- `pnpm exec tsc --noEmit`: pass.
+- Source evidence: broader adjacent 133 passed; full diagnostic 1,781 passed/2 skipped with two transient Windows `spawn EBUSY` tests passing 3/3 alone; pressure 1/1; Vite all targets pass.
+- Windows NSIS package and `verify:artifact:win`/`verify:artifact:pi` pass from source `b1657300f29f9744551f31029eb192ee82f01b92`. Installer: 208,297,578 bytes; SHA-256 `449288AF079E030F3F700F0FF1701971F7AB4806E0366CE989F4E8F2FE33ACA3`.
+
+## Follow-ups
+
+- Install the rebuilt client; the currently running installed binary cannot gain bundled resources from a source merge alone.
+- Pair it with a server deployment at migration 0078. Provider/pricing readiness remains server-owned and is not implied by catalog usability.
+
+## Promotion Candidates
+
+- None recorded.

.project-docs/40-domain/business-rules.md

@@ -19,6 +19,11 @@
 - System-included Data Service ships with MakeLore and has no Library acquisition,
   Admission, download, update, or device-uninstall action. Users may still enable it
   per project and assign its Skill to an Agent.
+- Code-owned Game Resource and Web Search are optional bundled hosted Plugins. Their
+  exact schema-2 manifests, Skills, and tools ship with MakeLore, so they have no
+  device download, update, Beta, signature, or device-uninstall state. Account Library
+  acquisition/removal, project enablement, Agent assignment, current server policy,
+  immutable Admission, explicit confirmation, and Token Point billing remain distinct.
 - Production Marketplace trust fails closed while the official Ed25519 public key is
   absent. Test-only/integration keys and packaged unknown-key rejection are evidence,
   not authority to activate production. Generic `platform_hosted` client execution is
@@ -38,8 +43,8 @@
   not expose Provider credentials, URLs, credit balances, raw responses, or Provider job
   IDs. Saving a hosted result must use bounded project-relative paths and the existing
   project write lease.
-- Native Web Search is a user-acquired `platform_hosted` Marketplace Plugin. Free
+- Native Web Search is a user-acquired code-owned bundled `platform_hosted` Plugin. Free
-  acquisition, device installation, project enablement, Agent assignment, current
+  acquisition, project enablement, Agent assignment, current
   Admission, and explicit per-search Token Point confirmation are separate gates.
   Only the frozen parent worker receives `makelore_web_search`; child workers receive
   no hosted tool. `submission_unknown` is result-less and must not auto-retry, while